Resources
- By null-byte: https://null-byte.wonderhowto.com/how-to/use-abuse-address-resolution-protocol-arp-locate-hosts-network-0150333/
- By Black Hills InfoSec: https://www.blackhillsinfosec.com/analyzing-arp-to-discover-exploit-stale-network-address-configurations/
- By Paulino (Packt): https://www.packtpub.com/en-us/learning/how-to-tutorials/optimize-scans/
- Deafult TLL : https://subinsb.com/default-device-ttl-values/
Commands
- Netdiscover
- Run in passive mode to silently listen for ARP requests. This is very stealthy.
netdiscover -i eth1 -p - Run an active scan on a specific range, printing results to the screen.
netdiscover -i eth1 -r 192.168.99.0/24 -P
- Run in passive mode to silently listen for ARP requests. This is very stealthy.
- p0f (Passive OS Fingerprinting)
- Listen on an interface and log all discovered hosts and OS information.
p0f -i eth1 -o p0f.log - Run in daemon mode (background process).
p0f -i eth1 -o p0f.log -d
- Listen on an interface and log all discovered hosts and OS information.
- arp-scan
- Scan the entire local network attached to the
eth1interface.arp-scan -I eth1 -l - Scan a specific subnet.
arp-scan -I eth1 192.168.99.1/24
- Scan the entire local network attached to the
- nping & fping
- Send a TCP probe to specific ports on a host.
nping -c 1 --tcp -p 80,443 192.168.99.12 - A fast ping sweep that only shows live hosts (
-a) and suppresses errors.fping -a -g 192.168.99.0/24 2>/dev/null
- Send a TCP probe to specific ports on a host.
- Bash
- A simple loop that pings each host in a /24 subnet and saves live hosts to
sweep.txt.NET="192.168.99"; for i in $(seq 1 254); do (ping -c1 -W1 $NET.$i > /dev/null && echo "$NET.$i" | tee -a sweep.txt &); done - Sort the results and clean up.
sort -u -t'.' -k4,4n sweep.txt > targets.txt && rm sweep.txt
- A simple loop that pings each host in a /24 subnet and saves live hosts to
- Windows CMD (Batch)
- The batch equivalent of the bash one-liner.
set "NET=192.168.99" && for /L %i in (1,1,255) do @ping -n 1 -w 200 %NET%.%i > nul && echo %NET%.%i >> sweep.txt
- The batch equivalent of the bash one-liner.
- PowerShell
- A PowerShell one-liner using WMI for ping checks.
echo "[*] Scanning in progress...";1..254 |ForEach-Object {Get-WmiObject Win32_PingStatus -Filter "Address='192.168.99.$_' and Timeout=50 and ResolveAddressNames='false' and StatusCode=0" |select ProtocolAddress* |Out-File -Append -FilePath .\sweep.txt};echo "[+] Live hosts:"; Get-Content -Path .\sweep.txt | ? { $_ -match "192.168.99" }; echo "[*] Done.";del .\sweep.txt - An alternative PowerShell method that runs pings in parallel.
$NET="192.168.99";for($i=1;$i -lt 255;$i++){$command="ping -n 1 -w 100 $NET.$i > nul 2>&1 && echo $NET.$i";start-process -nonewwindow cmd -argumentlist "/c $command" -redirectstandardoutput "tmp$i.txt"};cat tmp*.txt > sweep.txt
- A PowerShell one-liner using WMI for ping checks.
Tools
- nping: http://linux.die.net/man/1/nping
- Dnsbruter: https://github.com/RevoltSecurities/Dnsbruter
- p0f: https://github.com/skord/p0f
- Setezor: https://github.com/lmsecure/Setezor